upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-22 14:50:17 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 53

fix: add check for app_api_system session flag to bypass rate limit

Browse source 
Signed-off-by: Florian Klinger <florian.klinger@nextcloud.com>
Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>
This commit is contained in:
Florian Klinger 2024-03-12 10:53:14 +01:00 committed by Andrey Borysenko
parent 133a17aa96
commit f3a4abd98c
No known key found for this signature in database
GPG key ID: 934CB29F9F59B0D1
3 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/private/AppFramework/DependencyInjection/DIContainer.php
View file

@ -302,7 +302,8 @@ class DIContainer extends SimpleContainer implements IAppContainer {
$c->get(IRequest::class),
$c->get(IUserSession::class),
$c->get(IControllerMethodReflector::class),
$c->get(OC\Security\RateLimiting\Limiter::class)
$c->get(OC\Security\RateLimiting\Limiter::class),
$c->get(ISession::class)
)
);
$dispatcher->registerMiddleware(

7
lib/private/AppFramework/Middleware/Security/RateLimitingMiddleware.php
View file

@ -40,6 +40,7 @@ use OCP\AppFramework\Http\Response;
use OCP\AppFramework\Http\TemplateResponse;
use OCP\AppFramework\Middleware;
use OCP\IRequest;
use OCP\ISession;
use OCP\IUserSession;
use ReflectionMethod;
@ -70,6 +71,7 @@ class RateLimitingMiddleware extends Middleware {
protected IUserSession $userSession,
protected ControllerMethodReflector $reflector,
protected Limiter $limiter,
protected ISession $session,
) {
}
@ -81,6 +83,11 @@ class RateLimitingMiddleware extends Middleware {
parent::beforeController($controller, $methodName);
$rateLimitIdentifier = get_class($controller) . '::' . $methodName;
if ($this->session->exists('app_api_system')) {
// Bypass rate limiting for app_api
return;
}
if ($this->userSession->isLoggedIn()) {
$rateLimit = $this->readLimitFromAnnotationOrAttribute($controller, $methodName, 'UserRateThrottle', UserRateLimit::class);

6
tests/lib/AppFramework/Middleware/Security/RateLimitingMiddlewareTest.php
View file

@ -37,6 +37,7 @@ use OCP\AppFramework\Http\Attribute\UserRateLimit;
use OCP\AppFramework\Http\DataResponse;
use OCP\AppFramework\Http\TemplateResponse;
use OCP\IRequest;
use OCP\ISession;
use OCP\IUser;
use OCP\IUserSession;
use PHPUnit\Framework\MockObject\MockObject;
@ -77,6 +78,7 @@ class RateLimitingMiddlewareTest extends TestCase {
private IUserSession|MockObject $userSession;
private ControllerMethodReflector $reflector;
private Limiter|MockObject $limiter;
private ISession|MockObject $session;
private RateLimitingMiddleware $rateLimitingMiddleware;
protected function setUp(): void {
@ -86,12 +88,14 @@ class RateLimitingMiddlewareTest extends TestCase {
$this->userSession = $this->createMock(IUserSession::class);
$this->reflector = new ControllerMethodReflector();
$this->limiter = $this->createMock(Limiter::class);
$this->session = $this->createMock(ISession::class);
$this->rateLimitingMiddleware = new RateLimitingMiddleware(
$this->request,
$this->userSession,
$this->reflector,
$this->limiter
$this->limiter,
$this->session
);
}